Roadmap: context-aware shortcuts, system automation, and release trust

[zjlgdx]

Goal

Track the scoped work selected after a read-only comparison of Wink and Thaw. This issue is the dependency and product-boundary source of truth; each implementation remains one issue, one branch, one PR, and one verification loop.

Verified baseline

• Wink baseline: main@a7672dce.
• The repository had no open issues when this roadmap was created.
• Existing wink://toggle, wink://pause, and wink://resume were delivered by Automation interface: wink:// URL scheme and CLI for toggle semantics #355; recipes/import-export were delivered separately and are not Profiles.
• Thaw is GPL-3.0. It is a behavioral reference only; no Thaw source, assets, tests, corpus, or workflow may be copied into Wink.

Delivery queue

Independent product work

• Add App Intents and App Shortcuts for deterministic core actions #432 — deterministic App Intents/App Shortcuts
• Extend wink:// with safe search, settings, and idempotent focus commands #433 — safe wink:// search/settings/focus follow-up
• Guide users through binding and verifying their first shortcut in-app #434 — interactive first-shortcut success flow
• Make menu shortcut rows and Insights suggestions actionable #435 — actionable menu rows and Insights suggestions
• Add user-exportable diagnostics and a focused troubleshooting guide #445 — user-exportable diagnostics and troubleshooting

Strategic Profiles line

• [Design] Define Shortcut Profiles v1 data, identity, and switching contract #436 — approve Shortcut Profiles v1 design contract
• Implement Shortcut Profiles v1 as named shortcut sets #437 — implement that approved contract (blocked by [Design] Define Shortcut Profiles v1 data, identity, and switching contract #436)
• Apply Shortcut Profiles and pause state from macOS Focus Filters #438 — Focus Filter profile/pause overlay (blocked by Implement Shortcut Profiles v1 as named shortcut sets #437 and [Design] Define Shortcut Profiles v1 data, identity, and switching contract #436)

Release and supply-chain trust

• Harden GitHub Actions SHA pinning and update lifecycle #439 — enforce/update full-SHA GitHub Actions references
• Require Developer ID signing and notarization for public releases #440 — operationalize Developer ID + notarization for public releases (external Apple credentials required)
• Add an OSV dependency vulnerability gate with positive SwiftPM extraction proof #441 — OSV SwiftPM dependency gate (blocked by Harden GitHub Actions SHA pinning and update lifecycle #439)
• Establish a non-vacuous Swift CodeQL baseline and pull-request gate #442 — non-vacuous Swift CodeQL baseline (coordinate with Harden GitHub Actions SHA pinning and update lifecycle #439 for advanced setup)
• Generate and verify artifact attestations for final release DMG and ZIP #443 — attest final DMG/ZIP bytes (blocked by Harden GitHub Actions SHA pinning and update lifecycle #439; production proof reconciles with Require Developer ID signing and notarization for public releases #440)

Bounded research

• [Spike] Prove a deterministic Swift fuzzing path for URL and JSON parsers #444 — prove or reject a maintainable Swift fuzzing path; this spike does not become a required gate without evidence

Dependency graph

#436 Profiles design -> #437 Profiles implementation -> #438 Focus Filter

#439 Actions SHA lifecycle -> #441 OSV
                            -> #442 CodeQL (if advanced workflow)
                            -> #443 artifact attestations

#440 Developer ID/notarization ---------> #443 production release proof

Governing principles

• Keep ordinary App Intents separate from Focus Filters.
• Treat Shortcut Profiles as the strategic product line, but ship smaller independent improvements first.
• Preserve Wink's macOS 15 deployment target and current permission boundary; do not add Screen Recording.
• Use idempotent automation actions where possible. Never report an asynchronous activation/hide request as completed before Wink observes its final outcome.
• Runtime-sensitive work must carry exact-head packaged-app evidence under the repository's macOS validation policy.
• Supply-chain provenance, Developer ID/notarization, TCC designated requirements, and Sparkle signatures are separate trust mechanisms and must not be conflated.
• A green check with zero discovered packages, zero analyzed Swift files, or an unavailable suite is not positive verification.

Explicitly deferred

• A true-success x-callback protocol for activation/hide outcomes.
• Broad defaults write overrides for cooldown, debounce, F19, or other safety timings.
• Crowdin, Settings Search, arbitrary Profile scripts/hooks, and settings read/write URLs.
• Homebrew distribution until Require Developer ID signing and notarization for public releases #440 is operationally proven; Homebrew remains a separate ecosystem/release decision.

Completion

This roadmap closes only when every non-deferred child issue is either completed or explicitly re-scoped with a documented decision. Closing one child issue does not complete the roadmap.